Harry Maclean
4686718630
Ruby: Add kind to Http::Server::RequestInputAccess
...
Like in JS, this describes whether the input came from the request URL,
body, parameters, headers or cookie. Only some of these are relevant for
UrlRedirect and ReflectedXSS queries.
2022-10-13 13:24:16 +13:00
Harry Maclean
ad464abde2
Ruby: Model more params accesses
2022-10-13 13:24:16 +13:00
erik-krogh
66b3fe3425
add case-when expressions as a sink to rb/polynomial-redos
2022-10-12 19:57:01 +02:00
Alex Ford
0536d4b540
Merge branch 'main' into ruby/activejob-deserialize
2022-10-12 15:04:12 +01:00
Asger F
83464d48a9
Merge pull request #10773 from asgerf/rb/bugfix-singleton-class-resolution
...
Ruby: bugfix in type-tracking singleton class resolution
2022-10-12 13:45:16 +02:00
Nick Rolfe
39107047bf
Merge pull request #10735 from github/nickrolfe/actionmailer
...
Ruby: add `ActionMailer#params` as a `RemoteFlowSource`
2022-10-12 10:21:11 +01:00
Alex Ford
d3c8ce3f48
Ruby: ActiveSupport extends Pathname with an existence method that may return itself
2022-10-11 21:35:58 +01:00
Asger F
ed165c6194
Ruby: bugfix in self-resolution in type-tracking
2022-10-11 18:53:20 +02:00
Asger F
a64286b664
Ruby: add test for singleton class instance field
...
incorrect test output
2022-10-11 18:53:20 +02:00
Alex Ford
3d08a2954d
Ruby: add rb/unsafe-deserialization sinks for const_get args
2022-10-11 15:45:51 +01:00
Alex Ford
a3f096a6bc
Ruby: rb/unsafe-deserialization test realignment
2022-10-11 15:44:00 +01:00
Asger F
02656b16c3
Merge pull request #10685 from asgerf/rb/splat-and-local-field-step
...
Ruby: summarize unary splat operators and add local field step
2022-10-11 13:28:58 +02:00
erik-krogh
557dd10896
add a rb/unsafe-shell-command-construction query
2022-10-11 13:26:01 +02:00
erik-krogh
99b90789e5
add .shellescape as a sanitizer for rb/command-injection
2022-10-11 13:05:19 +02:00
erik-krogh
b16b3c0394
move cwe-078 tests into subfolders
2022-10-11 13:05:19 +02:00
erik-krogh
42e1735f2a
update expected output
2022-10-11 11:37:26 +02:00
erik-krogh
8779da8c0b
reintroduce Psych
2022-10-11 11:14:52 +02:00
erik-krogh
9a9d2a6fe1
Merge branch 'main' into rb-last-msg
2022-10-11 10:43:39 +02:00
erik-krogh
186205bd4b
add a test for explicit shell invocations using Kernel.open
2022-10-11 09:23:29 +02:00
erik-krogh
de3b15ebe9
add a query flagging uses of Kernel.open that are not with a constant string
2022-10-11 09:23:29 +02:00
erik-krogh
708f6b51f3
move cwe-078 tests into subfolders
2022-10-11 09:23:29 +02:00
Asger F
6daa1c432b
Ruby: update test output
2022-10-11 09:03:51 +02:00
Asger F
d55925d8d4
Ruby: support splat type-tracking step
2022-10-11 09:03:51 +02:00
Nick Rolfe
d61f0559a0
Ruby: add ActionMailer#params as a RemoteFlowSource
2022-10-10 10:23:48 +01:00
Alex Ford
ee77404006
Ruby: Add ActiveJob::Serializers.deserialize as a code execution sink
2022-10-09 22:28:22 +01:00
Alex Ford
4a39e4aac0
Ruby: Add new test case for rb/code-injection
2022-10-09 22:26:29 +01:00
Alex Ford
c4baf0b8fa
Ruby: add space for test case
2022-10-09 22:16:23 +01:00
Alex Ford
43fec9dfc8
Revert "Ruby: switch rb/sensitive-get-query back to using local flow"
...
This reverts commit fa58c51810
2022-10-09 13:06:13 +01:00
Alex Ford
139d3868e5
Merge branch 'main' into rb/sensitive-get-query
2022-10-09 12:26:44 +01:00
Nick Rolfe
a6674a5313
Ruby: fix uses of deprecated class name
2022-10-07 13:17:05 +01:00
Tom Hvitved
b065d2d3ab
Merge pull request #10705 from hvitved/ruby/singleton-overrides
...
Ruby: Take overrides into account for singleton methods defined on modules
2022-10-07 13:33:59 +02:00
erik-krogh
a0725fba71
fix some more style-guide violations in the alert-messages
2022-10-07 12:01:03 +02:00
Harry Maclean
75cb0efecb
Merge pull request #10538 from hmac/hmac/actioncontroller-parameters
...
Ruby: Model flow through ActionController::Parameters
2022-10-07 22:21:40 +13:00
Tom Hvitved
48bdf13c89
Ruby: Take overrides into account for singleton methods defined on modules
2022-10-06 11:56:26 +02:00
Tom Hvitved
7608276397
Ruby: Add more call graph tests
2022-10-06 10:38:02 +02:00
Tom Hvitved
0e6735b804
Merge pull request #10691 from hvitved/dataflow/conjunctive-clears
...
Data flow: Take conjunctive `With(out)Contents` into account in `prohibitsUseUseFlow`
2022-10-06 09:03:30 +02:00
Asger F
387e57546b
Merge pull request #10650 from asgerf/rb/summarize-more
...
Ruby: more type-tracking steps
2022-10-05 19:16:56 +02:00
Alex Ford
fa58c51810
Ruby: switch rb/sensitive-get-query back to using local flow
2022-10-05 15:58:05 +01:00
Asger F
decd4c93c7
Ruby: update type tracking test
2022-10-05 15:15:52 +02:00
Alex Ford
f01670f663
Ruby: add a note to a test case
2022-10-05 13:06:49 +01:00
Alex Ford
d64f8c73be
Merge branch 'main' into rb/sensitive-get-query
2022-10-05 12:59:35 +01:00
Alex Ford
977e8a8a6f
Ruby: add a test case for sensitive data from cookies for rb/sensitive-get-query (should not be flagged)
2022-10-05 12:57:07 +01:00
Arthur Baars
6509c19aad
Merge pull request #10692 from aibaars/fix-splats
...
Ruby: fix CFG and toString for anonymous '*' and '**'
2022-10-05 13:25:29 +02:00
Alex Ford
880fb2b14a
Ruby: split out rb/sensitive-get-query using query/customizations pattern
2022-10-05 11:59:40 +01:00
Tom Hvitved
e51c20bfc7
Data flow: Take conjunctive With(out)Contents into account in prohibitsUseUseFlow
2022-10-05 12:58:29 +02:00
Arthur Baars
a080f498be
Ruby: fix CFG and toString for anonymous '*' and '**'
2022-10-05 11:50:37 +02:00
Tom Hvitved
9d23742ed6
Ruby: Add test that illustrates issue with conjunctive WithoutContents
2022-10-05 11:26:23 +02:00
Asger F
f664a77a02
Ruby: ensure Hash flow works again
2022-10-05 11:07:55 +02:00
Arthur Baars
4ff85d5275
Ruby: add test case
2022-10-05 10:57:53 +02:00
Nick Rolfe
525fe12671
Merge pull request #10585 from github/nickrolfe/libxml-xxe
...
Ruby: detect uses of LibXML with entity substitution enabled by default
2022-10-05 09:51:39 +01:00
